CVE-2025-55423
Published: 20 January 2026
Description
A command injection vulnerability exists in the upnp_relay() function in multiple ipTIME router models because the controlURL value used to pass port-forwarding information to an upper router is passed to system() without proper validation or sanitization, allowing OS command injection.
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates validation and sanitization of the controlURL input prior to passing it to the system() function, preventing OS command injection.
Requires timely identification, reporting, and correction of the specific command injection flaw in the upnp_relay() function via patching or updates.
Restricts or disables non-essential UPnP relay functionality on ipTIME routers, eliminating the vulnerable attack surface where possible.
Security SummaryAI
CVE-2025-55423 is a command injection vulnerability (CWE-94) in the upnp_relay() function affecting multiple ipTIME router models. The flaw occurs because the controlURL value, which passes port-forwarding information to an upper router, is directly supplied to the system() function without validation or sanitization, enabling OS command injection. Published on 2026-01-20, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers with network access can exploit this vulnerability with low complexity and no user interaction required. By supplying a crafted controlURL, they can inject arbitrary OS commands, achieving high-impact confidentiality, integrity, and availability compromises, such as full router takeover.
Mitigation guidance and affected product details are documented in vendor and researcher advisories, including the ipTIME support page (https://iptime.com/iptime/?pageid=4&page_id=126&dfsid=3&dftid=583&uid=25203&mod=document), a Google Sheet tracker (https://docs.google.com/spreadsheets/d/1kryOFltCmnPJvDTpIrudgryt79uI4PWchuQ8-Gak24c/edit?usp=sharing), and GitHub resources listing impacted models in JSON format (https://github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/assets/affected_products_cve_format.json) and providing further analysis (https://github.com/0x0xxxx/CVE/blob/main/CVE-2025-55423/README.md).
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability in UPnP service enables unauthenticated remote exploitation of a public-facing application (T1190) and arbitrary OS command execution via Unix shell (T1059.004).